Whitelisting for allowed config files
New toolkit version with better safeName handling on uploads